GitHub Advisoryadvisory · crates.io

GHSA-p6gj-gpc8-f8xw Aliased mutable references from `tls_rand` & `TlsWyRand`

MEDIUM Published 2022-06-17 Modified 2022-06-17 Official page ↗
Ecosystem
crates.io
Packages
nanorand
Severity
Moderate
Reviewed
2022-06-17

Affected packages

• crates.io nanorand: >= 0.5.0, < 0.6.1 → fixed in 0.6.1

Description

`TlsWyRand`'s implementation of `Deref` unconditionally dereferences a raw pointer, and returns multiple mutable references to the same object, which is undefined behavior.

References